Apparatus for adopting authorizations

ABSTRACT

A method and apparatus for implementing a new Permission for methods that perform callback operations are provided. The method and apparatus provide an AdoptPermission Permission type that allows a method to pass a Java 2 authorization test without having the specific required Permissions expressly granted to the method and without the method having the AllPermission Permission granted to it. With the apparatus and method, an AdoptPermission Permission type is defined that operates to allow a ProtectionDomain to “adopt” a required Permission. However, this adoption of a required Permission can only be performed if the ProtectionDomain of at least one method in the thread stack has been granted a Permission that implies the required Permission. Thus, the AdoptPermission Permission type provides an intermediate mechanism that is not as over-inclusive as the AllPermission Permission type and is not as under-inclusive as requiring that all methods in the thread stack include the required Permission expressly granted to them.

This application is a continuation of application Ser. No. 10/639,862,filed Aug. 13, 2003 now U.S. Pat. No. 7,343,620, status i.e., allowed.

BACKGROUND OF THE INVENTION

1. Technical Field

The present invention is directed to an improved data processing systemand, in particular, an improved mechanism providing a new Permission formethods that perform callback operations.

2. Description of Related Art

In Java Development Kit (JDK) version 1.1, local applications and remoteprograms signed by a trusted entity were generally granted full accessto vital system resources, such as the file system. Unsigned remoteprograms, or remote programs signed by untrusted entities, could accessonly limited resources. A SecurityManager was responsible fordetermining which resource accesses were allowed.

In the Java 2 Software Development Kit (SDK), the security architectureis policy-based and allows for fine-grained access control. In Java 2SDK, when code is loaded by the ClassLoader, it is assigned to aProtectionDomain that contains a collection of Permissions based on thesecurity policy currently in effect. Each Permission specifies apermitted access to a particular resource, such as “read” and “write”access to a specified file or directory, or “connect” access to a givenhost and port. The security policy specifying which Permissions areavailable for code from various signers and/or locations can beinitialized from an external configurable policy file. Unless aPermission is explicitly granted to code, that code cannot access theresource that is protected by that Permission. These concepts ofPermission and policy enable the Java 2 SDK to offer fine-grained,highly configurable, flexible, and extensible access control. Suchaccess control can be specified for all Java code including but notlimited to applications, applets, Java beans, and servlets.

The Java 2 security architecture imposes the constraint that wheneveraccess to a protected resource is attempted, each class in the executionstack is checked for the required Permission to access that resource.This Permission checking is performed by the methodjava.security.AccessController.checkPermission( ). The security policywould be ineffective if code with no Permissions were able to invokecode with more Permissions and by doing so, access protected resourcesthat it should not access by virtue of its own ProtectionDomain.

It can be seen that with large programs having many methods and classes,it may be very cumbersome to identify all of the Permissions that arebeing used and to which classes the Permissions should be granted. TheJava 2 security architecture does provide some mechanisms for grantingPermissions without having to explicitly grant each and every Permissionthat would be necessary to ensure that a piece of code can work with allprotected resources.

For example, Java 2 SDK provides the AllPermission Permission type thatprovides a means by which all Permissions are granted to a class. Inpractice, AllPermission grants code the ability to run with securitydisabled. The security problems associated with using such a Permissionindiscriminately are apparent. This Permission is intended be used onlyduring testing, or in extremely rare cases where a program or library iscompletely trusted, and adding the necessary Permissions to the policyis prohibitively cumbersome.

Another tool provided through the Java 2 SDK is theAccessController.doPrivileged( ) method. Calling this method allows forthe checking of Permissions to access a protected resource to be haltedat the method that calls doPrivileged( ). In this way, the method callshigher in the thread stack than the method calling doPrivileged( ) areimplicitly granted the requisite Permissions to access the protectedresource. This method call is intended to be used in situations whereforcing the requirement that all method calls in the thread stack havethe expressly granted Permission to access the protected resource isimpractical or undesirable, such as with client code that callsApplication Program Interface (API) code.

A problem arises with the checking of Permissions when a “callback” inthe code is encountered. For example, assume that there are two classes“A” and “B”. Further, there is a method in “A” called “M1”, and a methodin “B” called “M2”. If “M2” obtains a reference to an instance of “A”(for example, through a method parameter, a return value from a methodinvocation, or a field), and calls M1 on that instance, then thelocation where this call occurs is called a callback.

If the Java 2 authorization system, implemented byAccessController.checkPermission( ), is called as a result of M2 callingM1, a problem arises because all of the active methods in the currentthread, including M2, need to be authorized for the privilegedoperation. If M1 or any of the methods subsequently called and appearingin the thread stack do not make a call to AccessController.doPrivileged(), then class “B” will be required to be authorized for the privilegedoperation, which means that it will have to have the required Permissionspecifically granted to it.

The most common case where this occurs is in general-purpose librarycode as is found in the Java runtime, which can be called by any clientcode. In particular, the client code calling library code can passparameters to the library code methods. These same parameters can thenbe used by the library code as receivers for method invocations. Ingeneral, the behavior of each of those client code methods is a prioriunknown (unless the declared type of the parameter is final, which meansthat it cannot be overwritten) because it depends on the client codeimplementation. As a result, it is not possible to know a priori whichPermissions will be needed by the parameters passed to the library code.

The current solution is to give class “B” in the library the Java 2AllPermission Permission, which is equivalent to the Permission toperform any Java 2 privileged operation, so that when a callback occurs,all methods in “B” will be authorized. In this way, when Java 2authorization calls are made as a result of a callback, theauthorization will succeed. However, one of the effects of allocatingAllPermission to class “B” is that it may result in a security holebecause class “B” becomes over privileged, violating the “Principle ofLeast Privilege”.

Thus, it would be beneficial to have an apparatus and method forimplementing a new Permission type that allows for callback methods tobe authorized using the Java 2 authorization system while not overprivileging other code and thereby creating security holes.

SUMMARY OF THE INVENTION

The present invention provides a method and apparatus for implementing anew Permission for methods that perform callback operations. The presentinvention provides an AdoptPermission Permission type that allows amethod to pass a Java 2 authorization test without having the specificrequired Permissions expressly granted to the method and without themethod having the AllPermission Permission granted to it.

With the apparatus and method of the present invention, anAdoptPermission Permission type is defined that operates to allow aProtectionDomain to “adopt” a required Permission. However, thisadoption of a required Permission can only be performed if aProtectionDomain of at least one method in the thread stack implies therequired Permission. Thus, the AdoptPermission Permission type providesan intermediate mechanism that is not as over-inclusive as theAllPermission Permission type and is not as under-inclusive as requiringthat all methods in the thread stack have the required Permissionexpressly granted to them.

When the Java 2 authorization system, implemented by theAccessController.checkPermission( ) method, is invoked to check thePermissions of the methods in a thread stack, ajava.security.AccessControlContext for the current thread is created.The list of ProtectionDomains is clipped at the stack frame preceding anAccessController.doPrivileged( ) stack frame. Thus, any method callsoccurring prior to the method calling AccessController.doPrivileged( )are not checked by the Java 2 authorization system. Any duplicateProtectionDomains in the AccessControlContext are removed and an orderedset of ProtectionDomains is obtained.

Since the Permissions granted to a thread of execution are obtained byintersecting the Permissions granted to all the ProtectionDomains in thethread's AccessControlContext, an AccessControlContext with fewerProtectionDomains is potentially more privileged. Therefore, a parentthread could gain additional privileges by just creating a child thread,which would have fewer ProtectionDomains in its AccessControlContext. Toprevent this from happening, the Java 2 authorization system forces achild thread to inherit its parent's AccessControlContext. If the childthread does not contain a call to AccessController.doPrivileged( ), theinherited AccessControlContext is merged with the currentAccessControlContext to create a merged and ordered ProtectionDomain setwhere the inherited AccessControlContext's ProtectionDomains are firstin the ordered set.

For each ProtectionDomain in the AccessControlContext, the implies( )method is run to determine if the ProtectionDomain implies the requiredPermission. If any ProtectionDomain is determined to not imply therequired Permission, a check is performed to see if the ProtectionDomaincontains the AdoptPermission Permission. If so, the authorizationrequested is passed even though the ProtectionDomain does not imply therequired Permission. Thus, the ProtectionDomain “adopts” the requiredPermission. However, if the first ProtectionDomain in the stack isreached and none of the ProtectionDomains imply the required Permission,but all of the ProtectionDomains have only been granted theAdoptPermission, then the authorization test is considered failed and aSecurityException is thrown.

These and other features and advantages of the present invention will bedescribed in, or will become apparent to those of ordinary skill in theart in view of, the following detailed description of the preferredembodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features believed characteristic of the invention are setforth in the appended claims. The invention itself, however, as well asa preferred mode of use, further objectives and advantages thereof, willbest be understood by reference to the following detailed description ofan illustrative embodiment when read in conjunction with theaccompanying drawings, wherein:

FIG. 1 is an exemplary diagram illustrating a distributed dataprocessing system according to the present invention;

FIG. 2 is an exemplary diagram of a server computing system according tothe present invention;

FIG. 3 is an exemplary diagram of a client computing system according tothe present invention;

FIG. 4 is an exemplary diagram illustrating a Java Virtual Machine;

FIG. 5 is an exemplary diagram illustrating the use of anAdoptPermission Permission type according to the present invention;

FIG. 6 is a flowchart outlining an exemplary operation of the Java 2authorization algorithm; and

FIG. 7 is a flowchart outlining an exemplary operation of the presentinvention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The present invention provides a mechanism by which a new Permission isemployed to allow methods in a class that perform callback operations tobe authorized for accessing a privileged resource without requiringAllPermission. As a result the security holes that might have beencreated by granting AllPermission are avoided.

The preferred embodiments of the present invention will be describedwith regard to the Java 2 SDK. However, the present invention is notlimited to use with the Java 2 SDK. Rather, the present invention may beused with any environment in which security policies are utilized toprotect access to computer system resources. Thus, the references toJava 2 SDK and elements of this programming environment are onlyintended to be exemplary and are not intended to imply any limitation onthe present invention.

Since the present invention operates in a Java security environment, abrief description of the Java computing environment will be provided. Asis well known, Java is typically used in a client/server or otherdistributed data processing environment, although Java may also be usedon a single computing device as well. As such, the following descriptionof the Java computing environment will assume a client/serverenvironment although the present invention may also be used by a singlecomputing device with or without a network connection.

With reference now to the figures, FIG. 1 depicts a pictorialrepresentation of a network of data processing systems in which thepresent invention may be implemented. Network data processing system 100is a network of computers in which the present invention may beimplemented. Network data processing system 100 contains a network 102,which is the medium used to provide communications links between variousdevices and computers connected together within network data processingsystem 100. Network 102 may include connections, such as wire, wirelesscommunication links, or fiber optic cables.

In the depicted example, server 104 is connected to network 102 alongwith storage unit 106. In addition, clients 108, 110, and 112 areconnected to network 102. These clients 108, 110, and 112 may be, forexample, personal computers or network computers. In the depictedexample, server 104 provides data, such as boot files, operating systemimages, and applications to clients 108-112. Clients 108, 110, and 112are clients to server 104. Network data processing system 100 mayinclude additional servers, clients, and other devices not shown. In thedepicted example, network data processing system 100 is the Internetwith network 102 representing a worldwide collection of networks andgateways that use the Transmission Control Protocol/Internet Protocol(TCP/IP) suite of protocols to communicate with one another. At theheart of the Internet is a backbone of high-speed data communicationlines between major nodes or host computers, consisting of thousands ofcommercial, government, educational and other computer systems thatroute data and messages. Of course, network data processing system 100also may be implemented as a number of different types of networks, suchas for example, an intranet, a local area network (LAN), or a wide areanetwork (WAN). FIG. 1 is intended as an example, and not as anarchitectural limitation for the present invention.

Referring to FIG. 2, a block diagram of a data processing system thatmay be implemented as a server, such as server 104 in FIG. 1, isdepicted in accordance with a preferred embodiment of the presentinvention. Data processing system 200 may be a symmetric multiprocessor(SMP) system including a plurality of processors 202 and 204 connectedto system bus 206. Alternatively, a single processor system may beemployed. Also connected to system bus 206 is memory controller/cache208, which provides an interface to local memory 209. Input/Output (I/O)bus bridge 210 is connected to system bus 206 and provides an interfaceto I/O bus 212. Memory controller/cache 208 and I/O bus bridge 210 maybe integrated as depicted.

Peripheral component interconnect (PCI) bus bridge 214 connected to I/Obus 212 provides an interface to PCI local bus 216. A number of modemsmay be connected to PCI local bus 216. Typical PCI bus implementationswill support four PCI expansion slots or add-in connectors.Communications links to clients 108-112 in FIG. 1 may be providedthrough modem 218 and network adapter 220 connected to PCI local bus 216through add-in boards.

Additional PCI bus bridges 222 and 224 provide interfaces for additionalPCI local buses 226 and 228, from which additional modems or networkadapters may be supported. In this manner, data processing system 200allows connections to multiple network computers. A memory-mappedgraphics adapter 230 and hard disk 232 may also be connected to I/O bus212 as depicted, either directly or indirectly.

Those of ordinary skill in the art will appreciate that the hardwaredepicted in FIG. 2 may vary. For example, other peripheral devices, suchas optical disk drives and the like, also may be used in addition to orin place of the hardware depicted. The depicted example is not meant toimply architectural limitations with respect to the present invention.

The data processing system depicted in FIG. 2 may be, for example, anIBM e-Server pSeries system, a product of International BusinessMachines Corporation in Armonk, N.Y., running the Advanced InteractiveExecutive (AIX) operating system or LINUX operating system.

With reference now to FIG. 3, a block diagram illustrating a dataprocessing system is depicted in which the present invention may beimplemented. Data processing system 300 is an example of a clientcomputer. Data processing system 300 employs a peripheral componentinterconnect (PCI) local bus architecture. Although the depicted exampleemploys a PCI bus, other bus architectures such as Accelerated GraphicsPort (AGP) and Industry Standard Architecture (ISA) may be used.Processor 302 and main memory 304 are connected to PCI local bus 306through PCI bridge 308. PCI bridge 308 also may include an integratedmemory controller and cache memory for processor 302. Additionalconnections to PCI local bus 306 may be made through direct componentinterconnection or through add-in boards. In the depicted example, localarea network (LAN) adapter 310, SCSI host bus adapter 312, and expansionbus interface 314 are connected to PCI local bus 306 by direct componentconnection. In contrast, audio adapter 316, graphics adapter 318, andaudio/video adapter 319 are connected to PCI local bus 306 by add-inboards inserted into expansion slots. Expansion bus interface 314provides a connection for a keyboard and mouse adapter 320, modem 322,and additional memory 324. Small computer system interface (SCSI) hostbus adapter 312 provides a connection for hard disk drive 326, tapedrive 328, and Compact Disk-Read Only Memory (CD-ROM) drive 330. TypicalPCI local bus implementations will support three or four PCI expansionslots or add-in connectors.

An operating system runs on processor 302 and is used to coordinate andprovide control of various components within data processing system 300in FIG. 3. The operating system may be a commercially availableoperating system, such as Windows 2000, which is available fromMicrosoft Corporation. An object-oriented programming system such asJava may run in conjunction with the operating system and provide callsto the operating system from Java programs or applications executing ondata processing system 300. “Java” is a trademark of Sun Microsystems,Inc. Instructions for the operating system, the object-orientedoperating system, and applications or programs are located on storagedevices, such as hard disk drive 326, and may be loaded into main memory304 for execution by processor 302.

Those of ordinary skill in the art will appreciate that the hardware inFIG. 3 may vary depending on the implementation. Other internal hardwareor peripheral devices, such as flash Read Only Memory (ROM) (orequivalent nonvolatile memory) or optical disk drives and the like, maybe used in addition to or in place of the hardware depicted in FIG. 3.Also, the processes of the present invention may be applied to amultiprocessor data processing system.

As another example, data processing system 300 may be a stand-alonesystem configured to be bootable without relying on some type of networkcommunication interface, whether or not data processing system 300comprises some type of network communication interface. As a furtherexample, data processing system 300 may be a personal digital assistant(PDA) device, which is configured with ROM and/or flash ROM in order toprovide non-volatile memory for storing operating system files and/oruser-generated data.

The depicted example in FIG. 3 and above-described examples are notmeant to imply architectural limitations. For example, data processingsystem 300 also may be a notebook computer or hand held computer inaddition to taking the form of a PDA. Data processing system 300 alsomay be a kiosk or a Web appliance.

FIG. 4 shows how a Java applet is handled using a Java Virtual Machine(JVM) that implements the Java 2 SDK security architecture. As shown inFIG. 4, a Web page 410 may include a hyperlink, or the like, to a Javaapplet 420. When a user of the Web browser 430 selects the hyperlink, orotherwise initiates the download of the applet 420, the applet code isfetched from the server 415 associated with the applet 420. Thisoperation is performed by a ClassLoader 445, which is also responsiblefor instantiating the applet as a class or set of classes 450. TheClassLoader 445 then assigns the applet class or set of classes 450 to anamespace 460. Before the fetched code can be executed, it is verifiedby the Class File Verifier 440.

At the time the classes 450 of the applet are instantiated, the JVM 470also builds a ProtectionDomain for the applet 420 classes 450. AProtectionDomain is a data structure in which a set ofjava.security.PermissionCollection objects is present. APermissionCollection is a grouping of Permissions assigned to the codeby the current security policy. Every time a developer defines a newPermission, the developer must also define a PermissionCollection towhich the new Permission belongs or assume the default implementation.These PermissionCollections are assigned to classes 450 of the applet420. Thus, when the classes are instantiated, the JVM looks at thePermissionCollections assigned to the classes and generates aProtectionDomain based on the assigned PermissionCollections.

The bytecode is then executed by the JVM 470. The bytecode is executedas threads of execution. A thread is a stream of execution. Threadsallow multiple streams of execution to occur virtually simultaneously ina data processing system thereby allowing multitasking. An executingthread has a thread stack. The thread stack is a mechanism for trackingwhich method calls which other method in order to be able to return tothe appropriate program location when an invoked method has finished itswork.

During execution, the applet 420 bytecode may make calls that attempt toaccess a protected resource, such as the file system, network, etc. Whensuch a call is made by the applet's thread of execution, the underlyingAPI calls a SecurityManager.checkPermission( ) method or another “check”method (e.g., SecurityManager.checkRead( ) orSecurityManager.checkConnect( )), based on the type of resource beingaccessed. This results in a call to AccessController.checkPermission( ),a method of the AccessController class 485.

The SecurityManager 480 is the part of a JVM that enforces the securitypolicy of the computing system on which the JVM is resident. When anuntrusted operation is to be performed by an application, theSecurityManager 480 is responsible for checking whether the applicationhas the appropriate Permission for performing the operation. Toaccomplish this, the SecurityManager's default implementation relies onthe AccessController.checkPermission( ) method.

A Permission represents the right to access a resource. In order for aresource access to be allowed, the corresponding Permission must beexplicitly granted to the code attempting the access. A Permission mayhave a target and, in some cases, a comma-separated list of one or moreactions. For example, the following code creates ajava.io.FilePermission object representing read access to the file namedabc in the /tmp directory:

perm=new java.io.FilePermission(“/tmp/abc”, “read”);

In this Permission, the target name is “/tmp/abc” and the action stringis “read”.

It is important to note that the above statement creates a Permissionobject that represents, but does not grant access to, a system resource.Permission objects are constructed and assigned, or granted, to codebased on the policy in effect. When a Permission object is assigned tosome code, that code is granted the Permission to access the systemresource specified in the current SecurityManager when making accessdecisions. In this case, the (target) Permission object is created basedon the requested access, and checked against the Permission objectsgranted to and held by the code making the request.

The security policy for an application environment is represented by ajava.security.Policy object. In the Java 2 reference implementation, thepolicy is file-based and can be specified within one or more policyconfiguration files. The policy file(s) specify what Permissions areallowed for code from specified code sources. A sample policy file entrygranting code from the /home/sysadmin directory read access to the file/tmp/abc is:

grant codeBase “file:/home/sysadmin/” { Permissionjava.io.FilePermission “/tmp/abc”, “read”; };

In the Java Development Kit 1.1, it was the responsibility of theSecurityManager to directly call a check method on untrusted resourceaccess requests in order to determine if the resource access requestshould be granted. In Java 2 SDK, the default SecurityManagerimplementation relies on the AccessController class 485 by calling theAccessController.checkPermission( ) method and passing it the relevantPermission object.

When the AccessController.checkPermission( ) method is called by theSecurityManager 480 with a Permission object as a parameter, theAccessController 485 retrieves the AccessControlContext for a thread ofexecution that resulted in the call of theAccessController.checkPermission( ) method. The AccessControlContextencapsulates an array of ProtectionDomains for the classes in the threadstack. Each class is mapped to its code source, represented as ajava.security.CodeSource object. A CodeSource is a combination of anorigination location of a resource access request and a set of zero ormore digital certificates, which are the certificates of the entitieswho signed the code attempting to perform the resource access.

Having retrieved the AccessControlContext, the AccessController 485calls an AccessControlContext.checkPermission( ) method on theAccessControlContext. The AccessControlContext.checkPermission( ) methodcalls the implies( ) method on each ProtectionDomain identified in theAccessControlContext to determine if the particular Permission beingchecked is implied by each of the ProtectionDomain objects. This causesan implies( ) method to be called on the appropriatePermissionCollection in each of the ProtectionDomains. Depending on thePermissionCollection's implementation, this typically causes an implies() method to be called on each Permission in the PermissionCollection. Inthis way, each ProtectionDomain identified in the AccessControlContextis checked to see if it implies to the Permission being checked.

If the results of this check indicate that any one of theProtectionDomains does not imply the requisite Permission, which is thePermission being checked, then the requested resource access is denied.Thus, all ProtectionDomains identified by the AccessControlContext mustimply the Permission being checked in order for the access request to begranted. This enforces the requirement that each ProtectionDomaininclude at least one PermissionCollection that implies the Permissionbeing checked.

Thus, in known systems, a developer of an application must possess asufficient amount of knowledge about the security policy and Permissionsof a particular computing system in order to make sure that the newapplication may work with the existing system and system resources. Thepresent invention allows for a developer to grant Permissions to classeswithout having to have a detailed knowledge of the security structure ofthe computing system but also without creating the security holespresent with the use of the AllPermission Permission type.

In a preferred embodiment of the present invention, when the Java 2authorization system, implemented by theAccessController.checkPermission( ) method call, is invoked to check thePermissions of methods in a thread stack, a determination is made as towhether at least one of the method calls in the thread stack has theassociated ProtectionDomain that implies the required Permission foraccessing the protected resource. If none of the methods in the threadstack have the associated ProtectionDomain implying the requiredPermission, the access attempt is denied and a SecurityException isthrown.

If at least one of the methods in the thread stack has the requiredPermission in its ProtectionDomain, then the other ProtectionDomains forthe other methods may have the new AdoptPermission Permission type intheir ProtectionDomains and thereby, do not need to have the requiredPermission in their ProtectionDomains. In this way, those method callsthat do not have the required Permission in their ProtectionDomains, buthave the AdoptPermission, “adopt” the Permission from the method callthat has the required Permission in its ProtectionDomain. As a result,the security check to determine if each method call in the thread stackis assigned the requisite Permission will succeed.

Thus, with the present invention, only the required Permission isadopted by use of the mechanisms of the present invention. With theAllPermission Permission type, known in the art, all Permissions aregranted to the associated method call—even those that are not requiredto access the protected resource. As a result, the method call isprovided with Permissions that it should not be granted and thus, asecurity hole is created. The present invention eliminates thispotential breach of security.

A detailed explanation of a preferred exemplary embodiment will now beprovided. With this preferred embodiment of the present invention, whenthe AccessController.checkPermission( ) method is called, anAccessControlContext for the current thread is created. The list ofProtectionDomains is clipped at the stack frame preceding anAccessController.doPrivileged( ) stack frame, if any. If there are morethan one AccessController.doPrivileged( ) calls on the stack, then thelist of ProtectionDomains is clipped at the stack frame preceding theAccessController.doPrivileged( ) call closest to theAccessController.checkPermission( ) stack frame. Thus, any method callsoccurring prior to the method calling AccessController.doPrivileged( )are not checked by the Java 2 authorization system. Any duplicateProtectionDomains in the AccessControlContext are removed and an orderedset of ProtectionDomains is obtained.

If there is an inherited AccessControlContext from a parent thread, andthe current thread does not contain a call toAccessController.doPrivileged( ), the inherited AccessControlContext ismerged with the current AccessControlContext to create a merged andordered ProtectionDomain set where the inherited AccessControlContext'sProtectionDomains are first in the ordered set. This is done to preventany thread to become over privileged by simply creating a moreprivileged child thread acting on the parent's behalf. Notice thatAdoptPermission typically is intended for library code, though it is nolimited to that purpose.

For each ProtectionDomain in the AccessControlContext, the implies( )method is run to determine if the ProtectionDomain implies the requiredPermission. If any ProtectionDomain is determined to not imply therequired Permission, a check is performed to see if the ProtectionDomaincontains the AdoptPermission Permission. If so, the authorizationrequested is passed even though the ProtectionDomain does not explicitlyimply the required Permission. Thus, the ProtectionDomain “adopts” therequired Permission. The authorization test succeeds if at least one ofthe ProtectionDomains in the AccessControlContext explicitly implies therequired Permission, while all the other ProtectionDomains eitherexplicitly imply the required Permission or are granted anAdoptPermission.

FIG. 5 illustrates an exemplary operation of the present invention witha thread stack in which the AdoptPermission Permission type is includedin one or more of the ProtectionDomains of the methods in the threadstack. With the present invention, the methodAccessControlContext.CheckPermission( ) is modified such that, aftercalling implies( ) on a ProtectionDomain with a particular Permissionobject as a parameter, if implies( ) returns a result of “false,” theAccessControlContext.CheckPermission( ) method verifies that theProtectionDomain contains AdoptPermission. If the ProtectionDomain doesnot include AdoptPermission, i.e. this second check returns a result of“false,” then the authorization test fails and a SecurityException isthrown. If either of the two tests returns a result of “true,” then theAccessControlContext.CheckPermission( ) method runs the same tests onthe next ProtectionDomain in the stack. The overall authorization testsucceeds if all the ProtectionDomains in the AccessControlContext implythe necessary permission or at least contain the AdoptPermission.However, at least one of the ProtectionDomain must explicitly imply therequired Permission. An example of this Permission check is provided inFIG. 5.

As shown in FIG. 5, methods are called in a top down order such thatmethod A calls method B, method B calls method C, method C callsSecurityManager.checkPermission( ), which then callsAccessController.checkPermission( ). TheAccessController.checkPermission( ) method performs a security check bycalling the implies( ) method on the ProtectionDomains of methods C( ),B( ), and A( ) in that order going from bottom to top of the threadstack.

As indicated in FIG. 5, the result of the authorization checks performedby the AccessController.checkPermission( ) method call are (1) method Cis checked and its associated ProtectionDomain includes the requiredPermission P, thus it passes the authorization check; (2) method B'sassociated ProtectionDomain does not include the Permission P but it hasbeen granted the AdoptPermission Permission type of the presentinvention. As a result, the authorization check passes; (3) method A'sassociated ProtectionDomain includes the required Permission P and thus,it passes the authorization check as well; (4) access to the protectedresource is granted because each of the methods pass the authorizationcheck. Notice that SecurityManager and AccessController both belong tothe system domain. In a traditional Java 2 environment, system classesare implicitly granted AllPermission. With the AdoptPermissionPermission type defined by the current invention, it is not necessaryfor system classes to be granted AllPermission. They may be granted anAdoptPermission as is needed. If the class does not require anyPermissions, it no longer needs to have AllPermission, norAdoptPermission. If a class does not explicitly need Permissions, but isknown to be on the call stack when an authorization test is performed,it can now have AdoptPermission instead of AllPermission.

If the thread stack shown in FIG. 5 were to include a call to theAccessController.doPrivileged( ) method call, theAccessController.checkPermission( ) authorization checks would stop atthe method calling doPrivileged( ) since it is assumed that all methodcalls higher up in the stack are temporarily exempted from thePermission requirement. In the event that a doPrivileged( ) method callis not present in the thread stack, the present invention allows methodswith an AdoptPermission to be granted the required Permission as long asanother ProtectionDomain for a method in the thread stack has therequired Permission. As a result, a method may be granted a requiredPermission without knowing what that Permission is a priori and withouthaving to grant all AllPermission to the method as in the prior art useof the AllPermission Permission type.

FIG. 6 is a flowchart outlining a prior art authorization mechanism.FIG. 6 will be contrasted with FIG. 7 which provides a flowchart of theoperation of the present invention.

As shown in FIG. 6, the operation starts with the creation of anAccessControlContext for the thread (step 610). The list ofProtectionDomains in the AccessControlContext is clipped at the stackframe preceding a call to doPrivileged( ) if any (step 620). Anyduplicate ProtectionDomains in the list of ProtectionDomains for theAccessControlContext, or the null ProtectionDomain, which corresponds tothe system domain, are removed from the list of ProtectionDomians forthe AccessControlContext (step 630). Any parent threadAccessControlContexts are then merged with the currentAccessControlContext so long as there is not a call to doPrivileged( )in the present thread (step 640).

Then, for each ProtectionDomain in the AccessControlContext, theimplies( ) method is run on the ProtectionDomain to see if theProtectionDomain implies the required Permission (step 650). If one ormore of the ProtectionDomains do not implies the required Permission, aSecurityException is to be thrown. The determination as to whether aSecurityException is to be thrown is made (step 660) and if so, accessto the protected resource is denied and the SecurityException is thrown(step 680). Otherwise, access to the protected resource is granted (step670) and the operation ends.

In contrast to the prior art authorization mechanism described above, anauthorization mechanism of the present invention is shown in FIG. 7. Thesteps 710-730 are similar to step 610-630 and thus, a description ofthese steps is not included here. For each ProtectionDomain in theAccessControlContext, the implies( ) method is run on theProtectionDomain to determine if it implies the required Permission(step 770).

A determination is made as to whether any of the checks using implies( )indicates that the ProtectionDomain does not imply the requiredPermission (step 780). If so, a determination is made as to whether thatProtectionDomain includes the AdoptPermission Permission type (step790). If not, the access attempt is denied and a SecurityException isthrown (step 760). Otherwise, if none of the ProtectionDomains fails theimplies( ) check or if those that fail have the AdoptPermissionPermission type, access to the protected resource is granted (step 800)and the operation ends as long as at least one of the ProtectionDomainsin the AccessControlContext explicitly implied the required Permissionand did not rely on the AdoptPermission to pass the authorization test.

Thus, the present invention provides a mechanism that allows for theadopting of Permissions from other ProtectionDomains in a securedmanner. The present invention eliminates the security risks generated byusing the AllPermission Permission type by providing a mechanism forgranting Permissions without known a priori what these Permissions maybe.

It is important to note that while the present invention has beendescribed in the context of a fully functioning data processing system,those of ordinary skill in the art will appreciate that the processes ofthe present invention are capable of being distributed in the form of acomputer readable medium of instructions and a variety of forms and thatthe present invention applies equally regardless of the particular typeof signal bearing media actually used to carry out the distribution.Examples of computer readable media include recordable-type media, suchas a floppy disk, a hard disk drive, a RAM, CD-ROMs, DVD-ROMs, andtransmission-type media, such as digital and analog communicationslinks, wired or wireless communications links using transmission forms,such as, for example, radio frequency and light wave transmissions. Thecomputer readable media may take the form of coded formats that aredecoded for actual use in a particular data processing system.

The description of the present invention has been presented for purposesof illustration and description, and is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the art. Theembodiment was chosen and described in order to best explain theprinciples of the invention, the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

1. A computer program product stored in a computer readable,recordable-type medium and operable by a data processing system forcontrolling access to a protected resource, the computer program productcomprising: first instructions for identifying a list ofProtectionDomains having one or more ProtectionDomains for a threadstack; second instructions for determining if each of the one or moreProtectionDomains implies a required Permission or has anAdoptPermission Permission type; and third instructions for grantingaccess to the protected resource if at least one ProtectionDomain in thelist of ProtectionDomains implies the required Permission and each otherProtectionDomain in the list of ProtectionDomains either implies therequired Permission or has the AdoptPermission Permission type, whereinthe AdoptPermission type permits a method call to adopt a requiredPermission without providing the method call with all Permissions andwherein at least one ProtectionDomain in the list of ProtectionDomainshas the AdoptPermission Permission type.
 2. The computer program productof claim 1, further comprising fourth instructions for denying access tothe protected resource if none of the one or more ProtectionDomainsimplies the required Permission, access to the protected resource isdenied.
 3. The computer program product of claim 1, wherein the list ofProtectionDomains is an AccessControlContext.
 4. The computer programproduct of claim 1, wherein the second instructions for determining ifeach of the one or more ProtectionDomains implies the requiredPermission include instructions for calling an implies( )method on eachProtectionDomain in the list of ProtectionDomains.
 5. The computerprogram product of claim 1, wherein the method call is a callbackmethod.
 6. The computer program product of claim 1, wherein the list ofProtectionDomains is a list of the ProtectionDomains associated with thethread stack clipped at an AccessController.doPrivileged( )method call.7. The computer program product of claim 1, wherein the list ofProtectionDomains is a merged list of ProtectionDomains that isgenerated by merging an inherited AccessControlContext with a currentAccessControlContext.
 8. The computer program product of claim 1,wherein the second instructions for determining if each of the one ormore ProtectionDomains implies a required Permission or has anAdoptPermission Permission type include: instructions for determining,for each ProtectionDomain in the one or more ProtectionDomains, if theProtectionDomain implies the required Permission; and instructions fordetermining, for each ProtectionDomain in the one or moreProtectionDomains that does not imply the required Permission, if theProtectionDomain includes the AdoptPermission Permission type.
 9. Thecomputer program product of claim 1, wherein the computer programproduct is part of a security manager of a Java virtual machine.
 10. Anapparatus for controlling access to a protected resource, comprising: adata processor coupled to a memory and operable for executinginstructions in the memory to perform steps of: identifying a list ofProtectionDomains having one or more ProtectionDomains for a threadstack; determining if each of the one or more ProtectionDomains impliesa required Permission or has an AdoptPermission Permission type; andgranting access to the protected resource if at least oneProtectionDomain in the list of ProtectionDomains implies the requiredPermission and each other ProtectionDomain in the list ofProtectionDomains either implies the required Permission or has theAdoptPermission Permission type, wherein the AdoptPermission typepermits a method call to adopt a required Permission without providingthe method call with all Permissions and wherein at least oneProtectionDomain in the list of ProtectionDomains has theAdoptPermission Permission type.
 11. The apparatus of claim 10, furthercomprising denying access to the protected resource if none of the oneor more ProtectionDomains implies the required Permission, access to theprotected resource is denied.
 12. The apparatus of claim 10, wherein themethod call is a callback method.
 13. The apparatus of claim 10, whereinthe determining if each of the one or more ProtectionDomains implies arequired Permission or has an AdoptPermission Permission type includes:determining, for each ProtectionDomain in the one or moreProtectionDomains, if the ProtectionDomain implies the requiredPermission; and determining, for each ProtectionDomain in the one ormore ProtectionDomains that does not imply the required Permission, ifthe ProtectionDomain includes the AdoptPermission Permission type.